CVE-2025-68637: Critical Apache Uniffle Flaw Exposes Clusters to Eavesdropping

CVE-2025-68637 is a high-severity flaw in Apache Uniffle, the remote shuffle service that underpins data movement for large distributed computing engines, with a CVSS score of 9.1 and implications for Apache Spark, Hadoop MapReduce and Tez clusters.

The vulnerability stems from an insecure default configuration in the Uniffle HTTP client, which was set to trust all SSL certificates and disable hostname verification, thereby exposing all REST API communications between the Uniffle CLI/client and the Uniffle Coordinator service to potential interception. An attacker on the network could present a fake certificate and intercept or manipulate control traffic without triggering alarms.

The issue affects all versions of Apache Uniffle prior to 0.10.0, and the Apache Uniffle team has released version 0.10.0 to enforce strict certificate validation and hostname verification, ensuring clients only talk to the legitimate Coordinator service. Administrators running Uniffle clusters are advised to upgrade immediately to prevent data interception in their distributed computing pipelines. 12 January 2026.